Listen to this Post
How the CVE Works
The vulnerability in Multer (>=1.4.4-lts.1) arises due to improper handling of malformed multi-part file upload requests. When an attacker sends a specially crafted request with corrupted headers or payload structure, Multer fails to process it gracefully, triggering an unhandled exception. This exception crashes the Node.js process, leading to a complete Denial of Service (DoS). The attack requires no authentication and can be executed remotely, making it critical for applications using Multer for file uploads.
DailyCVE Form:
Platform: Node.js
Version: >=1.4.4-lts.1
Vulnerability: DoS via malformed request
Severity: Critical
Date: May 19, 2025
What Undercode Say:
Exploitation:
- Craft a malicious multi-part request with invalid headers:
curl -X POST -F "[email protected];type=text/plain" http://target/upload
2. Use a fuzzer to automate payload variations:
import requests from fuzzers import multipart_fuzzer target = "http://target/upload" malicious_payload = multipart_fuzzer.generate_invalid() requests.post(target, files=malicious_payload)
Protection:
1. Upgrade to Multer 2.0.0 immediately.
2. Validate file uploads with middleware:
app.use((req, res, next) => {
if (!req.is('multipart/form-data')) {
return res.status(400).send('Invalid content-type');
}
next();
});
3. Rate-limit upload endpoints to mitigate brute-force attacks:
const rateLimit = require('express-rate-limit');
const uploadLimiter = rateLimit({ windowMs: 60000, max: 10 });
app.post('/upload', uploadLimiter, multer().single('file'));
Analytics:
- Attack Vector: Remote, unauthenticated
- Complexity: Low (no exploit code needed)
- Affected Systems: Node.js apps using Multer <=1.4.4-lts.1
- Mitigation Difficulty: Easy (patch available)
Detection:
Check for Multer version in `package.json`:
grep '"multer": "1.[0-4]."' package.json
References:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
